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DETAILED ACTION 

1. Claims 1-23 are pending and have been examined. 

Information Disclosure Statement 

2. The information disclosure statement (IDS) submitted on 03/01/2005 and 04/1 1/2005 
were filed before the mailing date of the first Office action on the merit. The submission is in 
compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure 
statement is being considered by the examiner. 

Drawings 

3. The drawings are objected to because Figure 13 recites misspelled "vistor" in item 1304 
and Figure 14 recites misspelled "indentified" in item 1404. Corrected drawing sheets in 
compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid 
abandonment of the application. Any amended replacement drawing sheet should include all of 
the figures appearing on the immediate prior version of the sheet, even if only one figure is 
being amended. The figure or figure number of an amended drawing should not be labeled as 
"amended." If a drawing figure is to be canceled, the appropriate figure must be removed from 
the replacement sheet, and where necessary, the remaining figures must be renumbered and 
appropriate changes made to the brief description of the several views of the drawings for 
consistency. Additional replacement sheets may be necessary to show the renumbering of the 
remaining figures. Each drawing sheet submitted after the filing date of an application must be 
labeled in the top margin as either "Replacement Sheet" or "New Sheet" pursuant to 37 CFR 
1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and 
informed of any required corrective action in the next Office action. The objection to the 
drawings will not be held in abeyance. 
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Specification 

4. The disclosure is objected to because of the following informalities: 

• [0048]: "tier 2 switch 122" references tier 3 switch in Figure 1, 

• [0048]: "tier 3 switch 124" is not illustrated in Figure 1 . 

• [0065]: "a mode change command 50&' is not illustrated in Figure 5. 

• [0067]: "virus warning 508" is not illustrated in Figure 5 or 6A. 
Appropriate correction is required. 

Claim Objections 

5. Claim 9 is objected to because of the following informalities: 

• Recitation of "... used for scan large..." where it should read -used for 
scanning large--. Appropriate correction is required. 

Claim Rejections - 35 USC §112 
The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out .and distinctly ^ 
claiming the subject matter which the applicant regards as his Invention. 

6. Claims 1-23 are rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. 

7. Claims 1, 10 and 17 recite "...the bandwidth of the network is substantially unaffected..." 
and "...without substantially reducing the flow of data packets thereby preserving network 
bandwidth..." as functions of the virus monitor. It is unclear however, how the virus monitor 
operations may or may not affect the bandwidth. 

8. Claim 4 recites the limitation "the data packet copy unit". There is insufficient 
antecedent basis for this limitation in the claim. 
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Claims 4 and 5 recite the limitation "the virus sensor unit". There is insufficient 
antecedent basis for this limitation in these claims. 

Claim 8 recites the limitation "the filescan unit". There is insufficient antecedent basis for 
this limitation in the claim. 

All other claims not specifically identified are rejected by virtue of dependency. 
Appropriate clarification is required. 

Double Patenting 

The nonstatutory double patenting rejection is based on a judicially created doctrine 
grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or 
improper timewise extension of the "right to exclude" granted by a patent and to prevent 
possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting 
rejection is appropriate where the conflicting claims are not identical, but at least one examined 
application claim is not patentably distinct from the reference claim(s) because the examined 
application claim is either anticipated by, or would have been obvious over, the reference 
claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed, Cir. 1998); In re 
Goodman, 11 F.Sd 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 
USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937. 214 USPQ 761 (CCPA 1982); In re 
Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 
USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be 
used to overcome an actual or provisional rejection based on a nonstatutory double patenting 
ground provided the conflicting application or patent either is shown to be commonly owned with 
this application, or claims an invention made as a result of activities undertaken within the scope 
of a joint research agreement. 

Effective January 1, 1994, a registered attorney or agent of record may sign a terminal 
disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b). 

9. Claims 1 -23 are provisionally rejected on the ground of nonstatutory obviousness-type 

double patenting as being unpatentable over claims 1 -33 of copending Application No. 

10683579 (hereinafter App. No *579). Although the conflicting claims are not identical, they are 

not patentably distinct from each other because Applicants' virus sensor operates in the same 

manner as the network virus/worm sensor in the copending Application. Considering claim 1 of 

the instant Application, the "switch" operation is later identified in claim 2 to be a function of the 

traffic controller whereas in copending App. No. '579 the limitation of the switch of modes as 
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facilitated by the traffic controller is present in claim 1 along with the other functions of the 
network virus/worm sensor. 

This is a provisional obviousness-type double patenting rejection because the conflicting 
claims have not in fact been patented. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent In the United 
states. 

10. Claims 1 - 23 are rejected under 35 U.S.C. 102(b) as being anticipated by Togawa et al. 
in US Patent No. 5918008 (hereinafter US '008). 

11. For claim 1 , US '008 discloses: 

In a distributed network of interconnected computing devices, a network virus monitor, 
comprising: 

a virus sensor operable in a number of modes arranged to detect a computer virus in the 
network such that the bandwidth of the network is substantially unaffected in a first mode 
wherein when the virus sensor detects the computer virus the virus sensor switches to a second 
mode such that only those data packets infected by the computer virus are not returned to the 
network, (see Abstract; column 2. lines 25 - 36; 39, 44 - 45, 48 - 49; Figure 2) 

For claim 2, US '008 teaches: 
A monitor as recited in claim 1 , further comprising: 

a traffic controller coupled to the virus sensor and the network arranged to select certain 
data packets wherein the selected data packets are fon^/arded to the virus sensor, (see column 
2, lines 25 - 27) 
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For claim 3, US '008 teaches: 
A monitor as recited in claim 2, wherein the traffic control unit further comprises: 

a data packet copier operable in the first mode arranged to generate a copied data 
packet of each of the selected data packets wherein the selected data packets are returned to 
the network, (see column 2, lines 27 - 31 ; column 4, lines 60 - 62, 65 - 67) 

For claim 4, US '008 teaches: 
A monitor as recited in claim 3 wherein the data packet copy unit is disabled in the second 
mode such that the selected data packets are passed to the virus sensor unit, (see column 2, 
lines 27 - 36; column 4, lines 65 - column 5, lines 1 - 5) 

For claim 5, US '008 teaches: 
A monitor as recited in claim 4, wherein the virus monitor further comprises: 

. a data packet protocol identifier coupled to the virus sensor unit arranged to identify a 
data packet protocol associated with the data packet infected by the computer virus, (see 
column 13, lines 1 - 9; Figure 4) 

For claim 6, US '008 teaches: 
A monitor as recited in claim 5, wherein the selected data packets are each associated with the 
data packet protocol associated with the computer virus such that only those data packets 
associated with the identified data packet protocol are selected from the network, (see column 
1 0, line 66 - column 1 1 , lines 1-5) 

For claim 7, US '008 teaches: 
A monitor as recited in claim 1 wherein the virus sensor unit further comprises: 

a filescan module arranged to scan a selected file for the computer virus, (see column 2, 
lines 30 - 34; Figures 2 and 17: item S173) 
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For claim 8, US '008 teaches: 
A monitor as recited in claim 7. wherein the filescan unit is remotely located, (see Figure 2) 

For claim 9, US *008 teaches: 
A monitor as recited in claim 8, wherein the remotely located filescan unit is used for scan large 
selected files, (see column 3, lines 28-31) 

For claim 10, US '008 discloses: 
A method of monitoring a distributed network of computing devices for a computer virus, 
comprising: 

at a virus monitor coupled to the distributed network; 

monitoring a flow of data packets in the network for the computer virus without 
substantially reducing the flow of data packets thereby preserving network bandwidth in a 
standby mode; (see column 3, lines 42 - 45) 

determining that at least one of the monitored data packets is infected with the computer 
virus; and (column 2, lines 25 - 36) 

monitoring the flow of data packets such that the infected data packets are not returned 
to the flow of data packets in an inline mode based upon the determining (column 3, lines 45 - 
47). (Abstract; Figure 2) 

For claim 1 1 , US '008 teaches: 
A method as recited in claim 10, further comprising: 

isolating a portion of the network infected by the computer virus; and 

cleaning the isolated portion of the network, (column 4. lines 15-19) 

For claim 12. US *008 teaches: 
A method as recited in claim 10, further comprising: 

sending a virus report to a controller, (see column 14. lines 25 - 27) 
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For claim 13, US '008 teaches: 
A method as recited in claim 10, further comprising: 

copying selected ones of the flow of data packets from corresponding original data 
packets retrieved from the flow of data packets based upon a packet type; and returning the 
retrieved data packets to the flow of data packets, (see column 2, lines 27 - 31 ; column 4, lines 
60 - 62 and 65 - 67) 

For claim 14, US *008 teaches: 
A method as recited in claim 13, wherein the packet type is determined by the detected 
computer virus, (see column 10, lines 57 - 65) 

For claim 15, US *008 teaches: 
A method as recited in claim 14, wherein a network bandwidth associated with the standby 
mode is substantially unaffected by the monitoring, (see column 3, lines 42 - 45) 

For claim 16, US '008 teaches: 
A method as recited in claim 14, wherein a network bandwidth associated with the inline mode 
is reduced by the infected data packets that are not returned to the flow of data packets, (see 
column 3, lines 45 - 47) 

For claim 17, US '008 teaches: 
Computer program product for monitoring a distributed network of computing devices for a 
computer virus, comprising: 

at a virus monitor coupled to the distributed network capable of executing computer 

code, 

computer code for monitoring a flow of data packets in the network for the computer 
virus without substantially reducing the flow of data packets thereby preserving network 
bandwidth in a standby mode; (see column 3, lines 42 - 45) 
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computer code for determining that at least one of the monitored data packets is infected 
with the computer virus; (see column 2, lines 25 - 36) 

. computer code for monitoring the flow of data packets such that the infected data 
packets are not returned to the flow of data packets in an inline mode based upon the 
determining (see column 3, lines 45 - 47); and 

computer readable medium for storing the computer code, (see Abstract; Figure 2) 

For claim 18. US '008 teaches: 
Computer program product as recited in claim 17, further comprising: 

computer code for isolating a portion of the network infected by the computer virus; and 

computer code for cleaning the isolated portion of the network, (column 4, lines'15 - 19) 

For claim 19, US '008 teaches: 
Computer program product as recited in claim 17, further comprising: 

computer code for sending a virus report to a controller, (see column 14, lines 25 - 27) 

For claim 20, US '008 teaches: 
Computer program product as recited in claim 17, further comprising: 

computer code for copying selected ones of the flow of data packets from corresponding 
original data packets retrieved from the flow of data packets based upon a packet type; and 

computer code for returning the retrieved data packets to the flow of data packets, (see 
column 2, lines 27 - 31 ; column 4, lines 60 - 62 and 65 - 67) 

For claim 21 , US '008 teaches: 
Computer program product as recited in claim 20, further comprising: 

computer code for determining the packet type using the detected computer virus, (see 
column 10, lines 57 - 65) 
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For claim 22, US '008 teaches: 
Computer program product as recited in claim 21, wherein a network bandwidth associated with 
the standby mode is substantially unaffected by the monitoring, (see column 3, lines 42 - 45) 

For claim 23, US '008 teaches: 
Computer program product as recited in claim 21, wherein a network bandwidth associated with 
the inline mode is reduced by the infected data packets that are not returned to the flow of data 
packets, (see column 3, lines 45 - 47) 

Conclusion 

12. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Zhao et al. in US Patent No. 7080407 discloses a virus detection and removal 
system and method for network-based systems. Libenzi in US Patent No. 71 17533 discloses a 
system and method for providing dynamic screening of transient messages in a distributed 
computing environment. 

13. Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to Laurel Lashley whose telephone number is 571-272-0693. The examiner 
can normally be reached on Monday - Thursday, alt Fridays btw 7:30 am & 5 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron, Jr. can be reached on 571-272-3799. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Laurel Lashley ^ 




Examiner 
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